Skip to main content

CryptoDefense: Keys pair stored on disk!

This little detail slipped through their fingers... TOO LATE!

 (I actually hid this post when I understood that it might alert the crooks. But SYMANTEC did!)

 This is the exact path where your keys are:
Windows XP
C:\Documents and Settings\<USERNAME>\Application Data\Microsoft\Crypto\RSA\S-1-5-2...
Windows 7
X:\Users\<USERNAME>\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21...
(X stands for your hard-disk letter, which is commonly C in most computers) 

HEXCMP highlights in red the differences whereas identical bytes remain white.
TCP/IP dumped data is identical to the key found on Disk. 

The private key is encrypted via DPAPI (Data Protection API). There are many RSA keys in that folder though, but you can still find them by sorting these files by date. If you don't remember the date you got infected, see your screenshot at the crook's webpage or search for the oldest HOW_DECRYPT.TXT file in your system.

 I'll update this blog soon!



Comments

  1. AnonymousMarch 26, 2014 at 9:22 AM

    I've got some nice small files, the key, and some timestamps... how should I get them to you?

    ReplyDelete
  2. AnonymousMarch 26, 2014 at 11:17 AM

    Not seeing nearly enough thanks being given to you for your hard work and efforts to remedy this douchebags handiwork. Excellent work man, and good luck with your efforts!

    ReplyDelete
  3. AnonymousAugust 21, 2014 at 10:42 AM

    I greatly appreciate all of your hard work, and if I can help in my limited way, please let me know.

    ReplyDelete

Post a Comment

Popular posts from this blog

Wana Decryptor / WanaCrypt0r

Alright, guys. This is a tough one: However, there's no reason to claim it's impossible to decrypt victims data. These idiots always let something slip through their fingers. Their servers might be found and keys restored to their respective victims. Errors might be found in their code, their key encryption scheme may have some weakness, etc. Let's just let the experts find a way out. By the way, if you want to temporarily protect your PC from this malware, you may do this.
Post a Comment
Read more

Software Utilities and Assistance

We have been requested many times to provide download links to all the tools we have used (and developed) to reverse the encryption schemes of some ransomware. These tools include Network Sniffers, TCP/IP Traffic Dumpers, Hex Editors, Debuggers and so on. For those of you who like to get hands down to work, we'll gladly provide you with them. If you are not a computer geek and just need assistance, send us an E-mail and we'll try to fix your problem. Bear in mind that we get many requests per day, so you must be patient! Sincerely, the HD team.
Post a Comment
Read more

Update: CryptoDefense rebranded to CryptoWall

After the fortune they reaped with CryptoDefense, not only did the crooks buy more computers from a bot net. They also rebranded it to 'CryptoWall' and made considerable changes to its website: + Multilanguage Support + Slight color changes in their website. Now it looks nicer, I confess. + Support (You can message them in case you need help)  - Their English sucks, so I haven't noticed any improvement in this area. * Ransomware notes are now named as: DECRYPT_INSTRUCTION.txt DECRYPT_INSTRUCTION.html DECRYPT_INSTRUCTION.url What does it mean to 'buy computers'? Most computers that were hit by this nasty ransomware had been previosuly infected by a botnet. A botnet is a network of infected computers that can be spied and controlled by their masters (those who own the botnet network).  These computer programs are usually used to gather users' credentials to home-banking and to perform DDoS attacks on websites, etc. (Yes, you can pay these croo
2 comments
Read more